WO2017092487A1

WO2017092487A1 - Mobile authentication method and device

Info

Publication number: WO2017092487A1
Application number: PCT/CN2016/100054
Authority: WO
Inventors: 胡志宏; 闵律
Original assignee: 胡志宏; 闵律
Priority date: 2015-12-01
Filing date: 2016-09-26
Publication date: 2017-06-08
Also published as: CN105528541A

Abstract

Provided is a mobile authentication method, comprising: a user terminal sending an authentication request to a server; the server sending encrypted authentication information to a mobile authentication device of the user terminal after receiving the authentication request; the mobile authentication device receiving the encrypted authentication information, and converting the encrypted authentication information to acquire identity authentication information when it is confirmed that the user terminal sends the authentication request; the mobile authentication device sending the identity authentication information to the server; and the user terminal passing authentication when the server confirms that the identity authentication information is correct. The advantages of the present invention lie in: information bypasses a user terminal by directly connecting to a network front end, thereby blocking an information access channel of various viruses and trojans that likely exist in a terminal, and improving the security of user sensitive information; moreover, since there is no direct communication between an authentication device and a user terminal, the compatibility problem of a new platform that is likely to occur in the future is also solved, thereby fundamentally solving the compatibility problem of the platform and the authentication device.

Description

Mobile authentication method and device

Technical field

The invention belongs to the field of information security, mobile payment and mobile communication, and particularly relates to a mobile authentication supporting internet user authentication, which can realize the functions of electronic signature and digital authentication on any networked platform and device, and get rid of the current verification device. The reliance on user terminals opens up dedicated channels for all types of sensitive information. Improve the security of all types of sensitive information.

Background technique

With the development of the Internet, the demand for various online certifications has greatly increased. At the same time, the need for certified devices has evolved from traditional PCs to more diverse mobile devices. Traditional authentication methods are experiencing increasing security and practical issues. In order to adapt to such changes, operators of major websites, including banks, games, and e-commerce, have begun to use security tokens to protect users' information security, including first-generation and second-generation U-Shields. These authentication devices effectively improve the security of user information.

However, the encrypted data currently passing through these security tokens is ultimately forwarded to the front end through the user terminal. Then, when the user terminal is monitored, the hacker cannot decipher the digital signature or the encrypted information, but can use the obtained data to impersonate the user to access the front end. This will affect the user's normal login and threats to the security of the user's account. At the same time, the current universal authentication device needs to use the physical and air interfaces supported by the mobile terminal when signing and encrypting the mobile terminal. Therefore, when signing for different mobile terminals, the security token needs to open a variety of different interfaces. This makes the variety of security tokens confusing for users and will not be available on uncompatible devices. These all limit the development of security tokens.

Summary of the invention

The object of the present invention is to provide a more convenient, fast and safe solution to the deficiencies of the existing various security tokens. By separating the authentication information from the general information, it is ensured that the sensitive information can bypass the monitoring that the user may encounter when logging in normally. Improve the security of user sensitive information. At the same time, free from the limitations of the platform, as long as the user has a mobile network in the region, the user can freely use on any platform without any physical and air interface. The problem of using security tokens on different devices is fundamentally solved. This not only improves the security of user information, but also greatly increases the compatibility and ease of use of digital tokens.

The present invention provides a mobile authentication method: a user terminal sends an authentication request to a server; after receiving the authentication request, the server sends encrypted authentication information to the mobile authentication device of the user terminal; the mobile authentication device receives the encrypted authentication information, and confirms When the user terminal sends the authentication request, the encrypted authentication information is converted into the identity authentication information; the mobile authentication device sends the identity authentication information to the server; the server confirms that the identity authentication information is correct, and the user terminal passes the authentication.

Further, the present invention provides a mobile authentication method, which may further have the feature that the user terminal transmits an authentication request by the confirmation module of the mobile authentication device.

Further, the present invention provides a mobile authentication method, which may also have the feature that the mobile authentication device displays related information that needs to be confirmed.

In addition, the present invention provides a mobile authentication device, including: a mobile communication module, which receives encrypted authentication information of a server; a security control module that uses an international common algorithm and a national secret algorithm to convert an encrypted authentication request into identity authentication information; and an operation module having Confirm module, confirm The user terminal sends an authentication request; the mobile communication module also sends the identity authentication information to the server.

Further, the present invention provides a mobile authentication device, which may further have the feature of further comprising a display module for displaying authentication related information.

Further, the present invention further provides a mobile authentication device, which may further have the following features: further comprising a battery and a power management module for providing power; the power management module is connected to the battery to supply power to the entire mobile authentication device.

Further, the present invention further provides a mobile authentication device, which may further have the feature that the operation module further includes a power switch module.

Further, the present invention further provides a mobile authentication device, which may also have the feature of performing identity authentication using an international standard PKI system digital certificate.

Further, the present invention also provides a mobile authentication device, which may also have the feature of managing by the authentication device PIN code.

Advantageous effects of the invention

The mobile authentication method and device provided by the invention directly connect the front end of the network, so that the sensitive information bypasses the user terminal in an intelligent manner, and blocks access to sensitive information of various viruses and Trojans that may exist on the terminal. Improve the security of user sensitive information. At the same time, because the authentication device and the user terminal do not have direct communication, the reliance of the authentication device on the user terminal platform is also removed, which not only realizes the versatility of the existing platform, but also solves the compatibility problem of the new platform that may appear in the future. The problem of compatibility between the platform and the authentication device is solved.

DRAWINGS

FIG. 1 is a structural diagram of a mobile authentication method according to the present invention.

2 is a flow chart of a mobile authentication method of the present invention.

3 is a structural diagram of a mobile authentication device of the present invention.

4 is a schematic diagram of a mobile authentication device of the present invention.

detailed description

The present invention will be further described below in conjunction with the drawings and specific embodiments.

2 is a flow chart of a mobile authentication method of the present invention.

As shown in FIG. 1 and FIG. 2, the mobile authentication method in this embodiment is performed between a user terminal, a server, and a mobile authentication device.

Step 1: The user terminal sends an authentication request to the server.

The user terminal sends an authentication request to the server through a network such as GPRS or 3G or 4G or IOT.

Step 2: After receiving the authentication request sent by the user terminal, the server sends the encrypted authentication information to the mobile authentication device of the user terminal.

The most basic information about the encrypted authentication information is the parameter of the one-time password generated by the server. The number of this parameter is randomly generated and is a token.

If the corresponding mobile authentication device has a display module, the encrypted authentication information may further include other related information of the authentication, such as a transaction amount, a payee, and the like.

Step 3: The mobile authentication device receives the encrypted authentication information, and confirms that when the user terminal sends the authentication request, the encrypted authentication information is converted to obtain the identity authentication information.

Step 3-1: The mobile authentication device corresponding to the user terminal has a mobile communication module, and the mobile communication module communicates with the front-end server through a network such as 2G, GPRS, EDGE, cdma1x, 3G, 4G. The mobile communication module of the mobile authentication device receives the authentication information sent by the server.

Step 3-2: The mobile communication module of the mobile authentication device transmits the information requiring authentication to the security control module and the display module of the device through the UART or the I2C or SPI interface.

The display module can facilitate the user to identify relevant information of the authentication, such as transaction amount, payee information and other readable information.

Step 3-3: The security control module waits for the user to confirm that the authentication is issued for the user terminal by using the confirmation module of the operation module.

The confirmation module can be a button, or a dialog box displayed on the touch screen, as long as the confirmation operation can be realized. When the confirmation button confirms that the authentication is issued by the user terminal, the security control module is configured to decrypt, convert, encrypt or digitally sign the transaction information by using an international common algorithm and a national secret algorithm to form a one-time identity authentication information.

The identity authentication information includes a one-time password converted according to the parameters of the one-time password generated by the server.

Step 3-4: The security control module transmits the identity authentication information to the mobile communication module of the mobile authentication device through the foregoing interface.

Step 4: The mobile authentication device sends the identity authentication information to the server; the server confirms that the identity authentication information is correct, and the user terminal passes the authentication. After the authentication is passed, the server receives the operation of the user terminal or performs subsequent operations such as data transmission.

During the entire authentication process, the mobile authentication device does not have any data transmission with the user terminal, that is, the physical isolation between the mobile authentication device and the user terminal is completely eliminated. What is the possibility of stealing encrypted information from the data transmission process.

As shown in FIG. 3 and FIG. 4, a mobile authentication device used in the embodiment includes a battery 1, a power management module 2, a security control module 3, a mobile communication module 4, a case module 5, and a display module 6.

Battery 1 is a 3.3V lithium battery. Used to power the entire system. The power management module 2 is used to connect the battery and supply power to the security control module, the mobile communication module, and other parts of the system. The power management module can also be externally charged.

The mobile communication module is used for communication between the device and the network front end that makes the authentication request through 2G (including GPRS EDGE cdma1x, etc., or also 3g, 4g, and others) networks. The mobile communication module is connected via a UART (or I2C, SPI) interface. The international standard PKI system digital certificate is used to authenticate the mobile communication.

A security control module for encrypting or digitally signing transaction information using international common algorithms and national secret algorithms.

The security control module receives the data from the mobile communication module, and returns the encrypted or signed data to the network front end through the mobile communication module, and encrypts the information to be sent by using an international common algorithm and a national secret algorithm. At the same time, OTP (one-time password) can be generated for more front-end requirements. The international standard PKI system digital certificate is used for identity authentication, and the use of the authentication device and the electronic signature are all managed by the authentication device PIN code.

The display module is an LED display that communicates with the security control module via an SPI (or I2C or 8080) interface to obtain information related to authentication. Display the content of the information from the web front end Authentication information and device status information from the local security control module.

The operation module in this embodiment includes: 2 buttons, the button 1 is the power on key, the button 2 is the confirmation button, the power switch of the mobile authentication device is realized, and the information is confirmed.

Of course, multiple buttons can be set in the operation module, such as the cancel button, to cancel the operation, or other function keys.

In addition, the operation module can be implemented in other manners without using a button, such as a dialog motor, or a voice confirmation, and is not limited to the manner proposed by the present invention. The device can store information on multiple websites and manage them separately.

Modification

The mobile authentication device may also have a judgment selection module. The security control module 3 stores a conversion encryption method corresponding to multiple servers.

While ensuring security, the mobile authentication device can separately manage the authorization information of multiple websites in the same device. According to different requests, the mobile authentication device can encrypt the authentication information from different websites using different encryption methods. Because the front-end server cannot and does not need access to information in the device throughout the process. So the information between multiple websites will not be shared with each other. While improving user safety, it also protects the interests of the company.

The judgment selection unit of the mobile authentication device first determines the account that needs to be authenticated, and then selects the algorithm and corresponding parameter of the corresponding account in the security control module 3, and calculates and completes the authentication. When registering a device, it records the information about the account and the algorithms and parameters that need to be used. And complete the registration by pressing the button.

In summary, the mobile authentication method and device provided by the present invention ensure that sensitive information can bypass the normal login of the user by separating the authentication information from the common information. Surveillance that may be encountered. Improve the security of user sensitive information. At the same time, free from the limitations of the platform, as long as the user has a mobile network in the region, the user can freely use on any platform without any physical and air interface. The problem of using security tokens on different devices is fundamentally solved. This not only improves the security of user information, but also greatly increases the compatibility and ease of use of digital tokens.

Claims

A mobile authentication method, characterized in that:

The user terminal sends an authentication request to the server;

After receiving the authentication request, the server sends the encrypted authentication information to the mobile authentication device of the user terminal;

Receiving, by the mobile authentication device, the encrypted authentication information, and confirming that the user terminal sends the authentication request, converting the encrypted authentication information to obtain identity authentication information;

The mobile authentication device sends the identity authentication information to the server;

The server confirms that the identity authentication information is correct, and the user terminal passes the authentication.
The mobile authentication method according to claim 1, wherein:

The confirmation module of the mobile authentication device confirms that the user terminal sends the authentication request.
The mobile authentication method according to claim 1, wherein:

Among them, the mobile authentication device displays relevant information that needs to be confirmed.
A mobile authentication device characterized in that it comprises

a mobile communication module that receives encrypted authentication information of the server;

The security control module converts the encrypted authentication request into identity authentication information by using an international common algorithm and a national secret algorithm;

An operation module, having a confirmation module, confirming that the user terminal sends an authentication request;

The mobile communication module also sends identity authentication information to the server.
A mobile authentication device according to claim 4, wherein:

A display module is also included for displaying authentication related information.
A mobile authentication device according to claim 4, wherein:

Also includes a battery and power management module that provides power;

The power management module is connected to the battery to supply power to the entire mobile authentication device;

The power management module can also be charged by an external power source.
A mobile authentication device according to claim 4, wherein:

The operation module further includes a power switch module; the operation module further includes a selection module or a cancellation module.
A mobile authentication device according to claim 4, wherein:

The method further includes a judgment selection module, and the security control module stores a conversion encryption method corresponding to the plurality of accounts;

After receiving the encrypted authentication information, the mobile authentication device determines that the selection unit determines the account that needs to be authenticated, and selects an account algorithm and a corresponding parameter in the security control module.
The mobile authentication device according to claim 4, characterized in that the international standard PKI system digital certificate is used for identity authentication.
The mobile authentication device according to claim 4, wherein the management is performed by authenticating the device PIN code.